canton-token-standard

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The AI prompt explicitly instructs the agent at runtime to "fetch the factory from the instrument's registry (map admin party-id → registry URL)" and use the returned disclosedContracts and choiceContextData to construct and exercise transfer choices, so the instrument's registry URL (the runtime registry URL) is a required external fetch whose content directly controls the agent's instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is explicitly designed to move tokens and perform on-ledger settlements. It specifies how to execute transfers via the JSON Ledger API (fetch TransferFactory from a registry, pass disclosedContracts and choiceContextData, then exercise TransferFactory_Transfer using submit-and-wait or prepare+execute for external signing). It also includes token-management operations (MergeDelegation, BatchMergeUtility, batched airdrops) and DvP settlement workflows. These are specific, concrete APIs/choices for executing financial transactions, not generic tooling.